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Foreword 


The role that man plays as a functioning element and as a potential source of error in space 
technology is widely recognized in a general way. NASA Reliability Publication NPC 250-1, en- 
titled ’’Reliability Program Provisions for Space System Contractors,” gives attention to this 
problem in calling for an intensive effort to eliminate potential sources of human- induced failure 
throughout a project’s life. 

In practice, there is a tendency either to implement a solution for this problem fully, with a 
formal program of human factors activities conducted by specialists, or to give it inadequate at- 
tention. Larger programs, particularly those in which the hardware is man-operated or man- 
rated, fall in the former class, and other programs frequently fall in the latter. 

Since all NASA systems, both manned and unmanned, must be fabricated, handled, tested, 
and operated, it is important that the design-development effort of any project, small or large, 
give an appropriate degree of attention to preventing human- induced failures, particularly in 
these areas; in effect, the effort must help in assuring human performance. The present publi- 
cation is intended to provide some guidance in determining what human-performance assurance 
effort is appropriate for various projects and to show how this effort relates to the various 
phases in the development cycle. The approach used provides a brief and concise description 
of: 


(1) The content and order of overall programs of human factors activities fitting the life 
cycle of different projects 

(2) The degree of pursuit appropriate for each of these elements of activity in the various 
kinds of projects 

Intensive coverage of each of the individual activities is beyond the scope of this document. For 
further pursuit in these areas, the text refers the reader to appropriate sources in the litera- 
ture. 

This publication was prepared for NASA Headquarters by the Martin Marietta Corp. under 
contract NASw-1128. The principal author is L. J. Lewandowski of the Baltimore Division of 
the Martin Marietta Corp., and the effort has been guided and edited by D. S. Liberman of this 
office. However, NASA field installations and Headquarters offices have provided significant 
assistance by constructively reviewing and commenting on the drafts; this assistance is grate- 
fully acknowledged. 

This document is directed toward reliability assurance personnel and project personnel and 
not toward human factors specialists. The information provided is generic and descriptive and is 
not intended to be mandatory. 


John E. Condon, Director 
Reliability and Quality Assurance 
Office of Industry Affairs 
NASA Headquarters 
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CHAPTER 1 


Introduction 


Since the advent of the "Space Age" (approximately October 1957), an increasing concern has 
grown over the problem of human error and its effects on space-program development. One of 
the driving forces in human- induced- failure investigations has been the increasing number of 
reported malfunctions directly traceable to human performance or lack of performance. Several 
studies (refs. 1, 2, and 3) have mentioned human-induced failures as the cause of as much as 40 
to 50 percent of all system discrepancies. Associated costs have been estimated in the millions 
without even including those of related problems such as increased hazard potential to man and 
machine . 

In order to offset these mounting costs, increased emphasis is being placed on measures to 
reduce and eliminate human-induced failures. In the area of assessment and analysis, attempts 
have been made to quantify human performance in the accomplishment of various system func- 
tions (ref. 4), but scarcity of data has severely limited progress in this area. However, con- 
siderable progress has been made in developing methods and techniques for detecting and elimi - 
nating potential human-error sources in the areas of design features, procedures, and various 
types of work situations. 

The present document deals with the latter approach. The purpose of this document is to 
present general guidelines and techniques applicable to space programs for reducing or elimi- 
nating sources of human- induced failures. 1 These guides are provided in support of NASA 
Reliability Publication NPC 250-1 (ref. 5), which specifies reliability program provisions for 
contractors. The paragraphs of reference 5 which relate to the prevention of human error are 
given in appendix A of the present paper. 

The approach used herein is: 

(1) To introduce the reader to these techniques within an overall framework of human engi- 
neering and serviceability functions, and to discuss them generally as they apply to 
projects of differing size and significance at each of the major phases of the projects 
evolutionary cycle. This is done in chapter 2. 

(2) To present an example in which the techniques are applied to a specific project. The 
system selected is a hypothetical Micrometeoroid Deep Space Satellite (MDSS), a con- 
cept representing an unmanned satellite project in the medium-to-small class in cost, 
complexity, and significance. Chapter 3 fully describes this MDSS example. 

A list of terms used in this publication and their definitions is given in appendix B. 


1 Although potentially useful for any space program, the information provided here is expected 
to be most useful to smaller projects which do not employ full-time human factors specialists. 
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CHAPTER 2 


Human Engineering and Serviceability in System Development 


This chapter provides a general overview of human engineering applications and service- 
ability for space programs of varying complexity, cost, and national significance. 

The first step in determining what kind of effort is appropriate for assuring effective man- 
machine interaction in any space program lies in examining the nature of the program itself. 

Each project has its own peculiar characteristics and requirements. The effort required for it 
will, therefore, depend on such interrelated program variables as: 

(1) Cost 

(2) Complexity 

(3) Experience with similar systems 

(4) Degree of national significance 

Little formal human engineering and serviceability activity, for example, would be required 
in developing an unmanned system to be built and used by highly experienced, knowledgeable per- 
sonnel familiar with both equipment and procedural tasks. At the other extreme, an extensive 
program would be initiated for situations where machines must be "human-proofed" (designed so 
that personnel with minimum training and experience can operate and maintain them) or "man- 
rated" (designed to meet specific standards of performance and reliability for manned flight mis- 
sions). The majority of space programs, however, do not conform to either of these extremes but 
fall in a broad intermediate category requiring varying degrees of human engineering effort. In 
order to assist in defining the nature and extent of this effort, this chapter first develops: 

(1) A method for classifying programs and systems according to mission complexity and 
significance 

(2) A list of human engineering and serviceability functions appropriate for specific develop- 
ment phases of the programs so categorized 

With regard to the first item, space programs and systems may be classified according to the 
eight separate categories of table I. An inspection of these categories reveals that one or more of 
them may be applicable for any given space program. A program such as the Apollo, for example, 
would be classified in categories A, D, and G. The reader must determine the number and kind of 
categories that most suitably represent his particular program and its systems. 

After a basis for categorizing space programs as given in table I has been established, levels 
of effort for human engineering and serviceability functions appropriate for implementation during 
each of the successive project phases for each of the various program categories may be identified 
and recommended as in table II. An unmanned spacecraft of average-to-low cost and complexity, 


2 A program of "high national significance," for instance, may be defined as one based on the 
highest standards and most rigid requirements for mission success. (Examples: A manned 
spacecraft, a man-rated launch vehicle, or a major space probe of the Surveyor class.) 
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Table I.— Space Project Hardware Categories 


Category 

Description 

A 

Manned spacecraft 

B 

Unmanned spacecraft which is highly complex and costly or of high 
national significance 

c 

Unmanned spacecraft of average or low complexity, cost, or national 
significance 

D 

Man-rated launch vehicle 

E 

Launch vehicle for category B spacecraft 

F 

Launch vehicle for category C spacecraft 

G 

Operational ground equipment (OGE) for category A or B spacecraft on 
category D or E vehicles 

H 

OGE for category C spacecraft on category F vehicles 


for instance, falls within the C category. It is then seen from table II that the appropriate human 
engineering functions for full attention 3 on this project are: 

(1) Prepare serviceability and maintainability analyses 

(2) Assist in development of operational and maintenance procedures 

(3) Review procedures and observe operational tests 

For this same spacecraft, lesser attention is advised in performing the following functions: 

(1) Review the system requirements, analyze the mission, and allocate functions by man- 
machine function analysis 

(2) Assist in predesign and design trade-offs 

(3) Participate in mockup activities 

(4) Participate in design reviews 

(5) Investigate and analyze human error sources during fabrication 

(6) Observe preparations for flight test and test support activities 

Finally, the table recommends that the activities not included in the two preceding lists be con- 
sidered as requiring only minimal effort for this class of project. 

Information from tables I and II can be applied to other projects in a similar manner. (See 
chapter 3 for a detailed example of how these tables are implemented during the design and de- 
velopment of a hypothetical, unmanned satellite in the average -to-low complexity class (theMDSS). 

If it is assumed that the appropriate human engineering program has been defined for a par- 
ticular system or project, a question arises as to the amount and kind of manpower required for 
implementing it. Manned systems, such as the Apollo, have employed from 40 to 50 human fac- 
tors engineers and life scientists during certain phases of design and development. Smaller 


3 Sinee this program will probably not have human engineering specialists, these functions 
should be performed by a member of the project team assigned to cover the human engineering 
area. 
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Table EL— Human Engineering and Serviceability Functions During System Development 


Activity 

Degree of participation 
required for space 
hardware category — 

A 

B 

c 

D 

E 

F 

G 

H 

Engineering design phase 

Predesign and early design activities 









Review system requirements and analyze mission (pp 6, 




% 





18 & 19) 

M 

Q 

0 

• 

• 

0 

• 

• 

Allocate functions by man- machine function analysis 

1 

■ 







(pp 6, 7 & 19 to 22) 

w 

1 

® 

• 

0 


• 

O 

Prepare operator task analyses 0 (pp 8, 22 & 23) 

1 

O 

O 

• 

EM 


• 

n 

Human engineering of displays , controls, work-space 

1 



* 

M. 

* 



layouts, etc. 0 (pp 8 & 22) 


O 

o 

• 

El 

O 

• 

o 

Prepare serviceability and maintainability analyses 0 

1 








(pp 8, 9 & 24 to 27) 


□ 

■ 

• 

• 

Q 

• 

• 

Assist in determining trade-offs involving human 

1 

I 







performance and serviceability; participate in pre- 

1 

■ 




1 



liminary design reviews 0 (pp 10 & 24) 

K3 

D 


• 

• 

E 

• 

m 

Hardware development and operations phase 

Development and prototype test activities 









Monitor incorporation of human engineering and 









serviceability criteria (pp 10, 11 & 25 to 28) 1 

• 

• 

® 

• 

• 

0 

• 

O! 

Prepare personnel requirements data (p 11) 

• 

o 

o 

• 

D 

o 

• 

0 

Assist in development of operational and maintenance 









procedures (pp 11 & 28 to 31) 


• 

• 


• 

• 

• 

• 

Participate in mockup and simulation activities 









(pp 12, 29 & 32) 


0 

m 

• 

O 

0 

• 


Participate in prerelease design reviews (pp 12 & 32) ... 

• 

• 

H 

• 

• 

Q 

• 

m 

Fabrication and flight hardware test activities 

■ 

■ 

■ 

■ 

1 

■ 

| 

IHj 

Investigate and analyze human error sources 



1 


I 

p 


1 

(pp 13 & 32) 


1 


1 





Perform observational studies; make recommendations 

1 



1 

I 



■ 

(pp 13 & 14) 

1 

D 

o 

1 

P 

O 

1 


Pre launch and operational activities 


■ 


■ 

■ 

m 

■ 

■ 

Review procedures and observe operational tests 


■ 


I 

1 



| 

(pp 14 & 33) 

□ 

□ 

H 

□ 

n 

□ 

□ 

□ 

Observe maintenance and support operations (pp 14&33). . 

□ 

D 

K3 

D 

D 

0 

D 

El 


Legend: 


• Needs active formal participation of human engineering technologies. 

$ Needs less attention to human engineering considerations (as a part of other 
engineering effort) . 

O Factor for consideration, but only minimal formal effort is required. 

♦ Applies primarily to planning for checkout and countdown features. 

c This task continues or is refined later during development and prototype test 
activities. 
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unmanned satellite programs generally either do not require human factors specialists, or, at the 
maximum, require the services of consultants for only limited time periods. System and design 
engineers working on the latter programs must usually provide the proper attention to human 
factors . 

The reader may estimate the amount and kind of human factors participation recommended 
for his program by reviewing its unique requirements in conjunction with the information in table 
II. The following paragraphs describe the human engineering functions listed in table II for each 
of the program phases. 


PREDESIGN AND EARLY DESIGN ACTIVITIES 

REVIEW SYSTEM REQUIREMENTS AND ANALYZE MISSION 

The first task in planning the human engineering effort for any program is to analyze its gen- 
eral and functional requirements. A list of things to be done by (or to) the system and the con- 
straints under which they must be accomplished will result. This review provides the basis for 
planning all subsequent human engineering functions. 

The review of system requirements is followed by a mission analysis, which describes the 
mission with sufficient clarity to facilitate further the performance of human engineering analyses 
and efforts. Steps in this analysis are: 

(1) Determination of the sequence of basic functions and events that the system will perform 
or encounter throughout its mission life. 

(2) Separation of this sequence into segments as necessary to facilitate description. 

(3) Preparation of flow charts and time-line analyses for each segment of the mission 
sequence. 

The degree of formality and detail used in performance of human engineering mission analysis 
will vary with the complexity, criticality, cost, and significance of the system and mission. If 
the system in question involves the higher levels of these factors, each step in the foregoing 
sequence would be carried out in a fully formalized manner. On the other hand, systems charac- 
terized by lesser levels of these factors might well permit the development of plans for further 
human engineering activities almost directly from the description of the sequence of mission 
functions or might require only minimal formalization of the intermediate steps. (Reference 6 
contains a description of these activities for project Apollo, while chapter 3 of the present publi- 
cation describes the analogous activity for a hypothetical small unmanned satellite (the MDSS).) 

FUNCTION (MAN-MACHINE) ANALYSES 

The preceding review of system requirements serves as a guide in preparing the function anal- 
ysis. 4 A function analysis identifies what the roles of man and machine, and their interaction, will 
be for meeting each of the requirements imposed on a system. The degree of detail involved in 
performing the analysis will depend on the space program category involved (see table II). An ex- 
ample of a function analysis format for a typical OGE function may be found on pages 20 and 21. 

In order to assist in making any allocation of man- machine activities, several listings are 
available as guides for determining which functions or operations a man can do better than a 


4 The man-machine analysis made at this time is subject to further refinement and verifica- 
tion based on detailed human engineering task analysis and design trade-off activities which occur 
as later steps in the design process. 
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machine and those which a machine can perform better than man. These lists have been summa- 
rized in table HI. 


Table m.— Man-Machine Capabilities 


Human superiority 

Machine superiority 

1. Originality (ability to arrive at new, 

1. Precise, repetitive operations 

different problem solutions) 


2. Reprogramming rapidly (as in ac- 

2. Reacting with minimum lag (in micro- 

quiring new procedures) 

seconds, not milliseconds) 

3 . Recognizing certain types of impending 

3. Storing and recalling large amounts of 

failures quickly (by sensing changes in 

data 

mechanical and acoustic vibrations) 


4. Detecting signals (as radar scope re- 

4. Being sensitive to stimuli (machines 

turns) in high-noise environments 

sense energy in bands beyond man's 


sensitivity spectrum) 

5. Performing and operating though task- 

5. Monitoring functions (even under stress 

overloaded 

conditions) 

6. Providing a logical description of 

6. Exerting large amounts of force 

events (to amplify, clarify, negate 

7. Reasoning deductively (in identifying a 

Utllcl Udld/ 

specific item as belonging to a larger 

7. Reasoning inductively (in diagnosing a 

class) 

general condition from specific symp- 


toms) 


8. Handling unexpected occurrences (as 


in evaluating alternate risks and 


selecting the optimal alternate, or 


corrective action) 


9. Utilizing equipment beyond its limits 


as necessary (i.e., advantageously 


using equipment factors of safety) ' 



One of man's greatest limitations when functioning as a system component is his low informa- 
tion-handling rate, even when he is engaged in a single task (ref. 7). This limitation, in turn, is 
further degraded by man's limited buffer storage (immediate memory) capacity. On the plus side, 
however, are: 

(1) Man's ability to handle a great variety of different information-processing tasks 

(2) Man's capability to adapt to new tasks or environments and learn new skills 

(3) Man's judgmental ability in devising newly required procedures or resolving unexpected 
contingencies 

The primary objective, therefore, in man- machine analysis is not the determination of 
whether a man will do a better job than a machine but rather of whether he can do an adequate one 
for less money, less weight, and less power and with a smaller probability of failure and need for 
maintenance. 
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OPERATOR TASK ANALYSES 

The function analysis previously discussed deals with the allocation of system functions to 
man or machine or a man-machine combination. The next human engineering activity to be per- 
formed requires a more detailed analysis of each manned or semiautomated function in order to 
arrive at human information and response requirements which will serve as design inputs. This 
type of analysis is broadly called a task analysis; it involves time-line analysis in most cases and 
is supplemented by link analyses in the most extreme cases (see appendix B for definitions). For 
highly complex manned systems or operations, such as maimed spacecraft, it is essential to con- 
duct these analyses in considerable detail in order to assess man-machine design requirements 
and to obtain necessary basic information for establishing personnel requirements and training 
requirements. However, task and time-line analyses in a generally less detailed form are also 
of value for smaller systems as an aid in establishing certain design requirements and in de- 
termining operator task loading and the time scheduling of portions of the operating sequences. 

The basic elements of task analyses are descriptions of: 

(1) Operator inputs and outputs in system operation and maintenance 

(2) Equipment inputs and outputs 

(3) Skills and knowledges required in task performance 

(4) Potential equipment malfunctions 

(5) Characteristic human errors to watch for and prevent 

A task analysis format used for analyzing operational ground equipment during the Gemini 
program is given as exhibit 1. An example of an analysis for an unmanned satellite activity is 
given in chapter 3 as exhibit 3. 

HUMAN ENGINEERING OF DISPLAYS , CONTROLS , AND OTHER EQUIPMENT FEATURES 

The foregoing task analyses provide basic data for attaining the primary goal of human engi- 
neering: to design equipment to simplify the requirements imposed on man. The equipment in the 
Gemini case includes both that used onboard spacecraft in their operation and control and that used 
in their operational test support and maintenance activities. It will involve such major compo- 
nents as displays, controls, panels, and chassis and their operational configuration or work-space 
arrangement. 

The human engineering of equipment design is thoroughly described in a number of texts and 
manuals in this field (see refs. 8, 9, and 10). Both empirical studies and intuitive "common 
sense" experience have been used in deriving principles and specifying design requirements and 
criteria. Two of the most recent documents in this area especially addressed to design engineers 
working on space programs are references 11 and 12. 

SERVICEABILITY AND MAINTAINABILITY ANALYSES 


Genera/ Considerations 

One of the most important tasks associated with the human engineering of spacecraft and as- 
sociated operational ground equipment involves preparing serviceability and maintainability anal- 
yses. As a means of human error prevention, these analyses are concerned with manned activi- 
ties in maintaining systems in an efficient and safe way (especially during prelaunch operations). 
They contribute to the development of equipment onboard orbital vehicles as well as to the design 
and/or selection of displays, controls, consoles, and facilities to test and maintain them. 

Although important for any space project, serviceability analyses are especially required 
when the mission contains critical launch window constraints (as on the Gemini program, ref. 13) 
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Exhibit 1.— Example of a task analysis worksheet for 
Gemini operational ground equipment. 
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or susceptibility to single-point failures through human error in prelaunch operations. Service- 
ability analyses lead to basic hardware decisions involving: 

(1) Location of test and service points 

(2) Mounting and packaging of components 

(3) Location of maintenance access panels 

(4) Types of connectors and fasteners required 

(5) Routing of lines and cables 

(6) Any other design feature which will make it difficult to damage or destroy equipment 

The foregoing items are considered with a number of others in a detailed description of a 
serviceability analysis for a typical unmanned satellite program. (See chapter 3.) 

Safety Features 

In the predesign/design phase, safety features pertaining to both personnel and equipment are 
also identified and specified through human engineering and serviceability analyses. These help 
to detect hazardous and potentially hazardous conditions in the planned operating and test environ- 
ments. Safety provisions usually recommended include: 

(1) Fail-safe features in critical launch control and airborne equipment 

(2) Lock-out switches or guarding of controls which initiate hazardous operations (such as 
crane movement, engine ignition, etc.) 

(3) Protection against premature squib ignition 

(4) Crew safety devices including emergency escape equipment 

(5) Equipment design features which minimize or remove electrical, mechanical, and toxic 
hazards to personnel 

(6) Adequate illumination in both work and test areas 

(7) Effective warning devices (visual and auditory) 

(8) Adequate accessibility 

(9) Noise control 

(Safety feature examples are listed with the serviceability and maintainability tables in chapter 3.) 

DESIGN TRADE-OFFS 

An important, continuing function in the design phase is to assist those engineers concerned 
with making design trade-offs. These trade-offs will involve reviewing the requirements of human 
engineering, reliability, maintainability, logistics, and other functional specialty areas on pre- 
liminary equipment design. 

In order to support trade-off decisions, information on manned functions and activities (from 
initial task and serviceability analyses) must be clearly and efficiently presented to responsible 
system and project engineers during early design. 

Design features considered as having very slight effect in causing human errors may be al- 
lowed during the making of trade-off decisions. However, data and assumptions underlying all 
trade-offs must be documented in order to have this information available for subsequent design 
reviews. Some deficiencies may occur later which are directly traceable to human engineering 
design features initially recorded as "having only slight effect." It will then become necessary to 
reclassify these features as significant sources of potential system failure. 

DEVELOPMENT AND PROTOTYPE TEST ACTIVITIES 

The primary human engineering effort during development testing is to assure that adequate 
human performance and serviceability criteria have been met in equipment design. This is 
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essentially a monitoring activity which includes continuous, timely review of drawings, test 
practices and procedures, manufacturing plans and procedures, and design changes with project 
personnel. 

In addition to monitoring, the development test phase includes such human engineering func- 
tions as: 

(1) Preparing personnel requirements information 

(2) Assisting in developing procedures 

(3) Participating in simulation and/or mockup activities 

PERSONNEL REQUIREMENTS DATA 

Personnel requirements data are descriptions of the number and kinds of personnel required 
to perform each of the significant tasks in the operation, maintenance, test, and handling of a 
space system. This information is usually generated during the development stage of the project. 
As with most other human engineering tasks , the degree of formality necessary in preparing 
personnel requirements data depends on the complexity of the system and significance of the pro- 
gram. These data serve as a basis for: 

(1) Production of instructional materials and aids 

(2) Development or procurement of training devices 

(3) Preparation of test, operational, and maintenance procedures and plans 

The last item, which is an integral part of all space programs regardless of complexity, is 
described more fully as follows. 


DEVELOPMENT OF PROCEDURES 

When the number and kind of personnel required for a particular space system have been esti- 
mated, the next step is to assist in developing appropriate procedures for equipment operation and 
care. Since inadequate procedures have been found to be a primary source of human error, it is 
highly important to provide clear descriptions of what the operator is to do in checking out, test- 
ing, operating, and maintaining airborne and operational ground equipment. The following items 
should be stressed in all procedures preparation: 

(1) Information should be presented clearly and completely in a step-by-step format 

(2) Supplementary tables, charts, figures, etc. should be included only to clarify procedural 
steps 

(3) Superfluous or confusing items (verbiage, etc.) should be avoided 

(4) Procedures should be revised concurrently with design or prototype test changes 

(5) Provisions should be included for handling contingencies or discrepancies, including those 
with which an operator may be unfamiliar 

(Exhibits 4 and 5 in chapter 3 are specific examples comparing desirable and undesirable features 
in test procedures.) 

Item (5) calls attention to problems which an operator may meet outside his normal work op- 
erations. The other four items emphasize the need for thorough, clear, and effective instruc- 
tional material to cover his normal, everyday activities in manufacturing and test areas. 
Documents such as manufacturing plans, safety procedures, work orders, and operating pro- 
cedures are included. The supervision must foster a basic awareness and understanding of the 
need to follow these established practices as an important means of eliminating human-induced 
equipment failures. 
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SIMULATION ACTIVITIES 

After preliminary equipment design inputs and contributions to procedure preparation, hu- 
man engineering efforts for larger programs (as the Apollo or Gemini) usually become involved 
with mission or function simulators. For unmanned programs, the use of simulators as such is 
rare. 

During the simulation period, one is concerned with identifying design characteristics, en- 
vironmental factors, and operational contingencies which might adversely affect personnel. Test 
rims are performed under both routine and emergency conditions. Data collected from these runs 
are analyzed for actual and potential causes of equipment malfunctions due to human error. (A 
description of crew performance during simulated lunar missions may be found in ref. 14.) 

A special case considered as a functional equivalent of simulator usage is that involving mis- 
sion operations training activities. Typically, the mission operations area includes an intimate 
interfacing of personnel, equipment, and procedures used to track, command, and receive data 
from a spacecraft. This area is important for all space missions, and its importance is pro- 
portional to the degree of dependence of the mission on the successful performance of the mission 
operations system. Since this area is heavily dependent on effective human performance, an ex- 
tensive program of simulated mission exercises is usually conducted by mission operations ac- 
tivities in order to detect and eliminate deficiencies in procedures as well as aspects of equip- 
ment design (or computer programs) which may lead to human error. 

MOCKUP ACTIVITIES 

Mockups and prototype equipment are important three-dimensional engineering tools used to 
determine the operational suitability of unmanned spacecraft and operational ground equipment. 
Whereas simulators and mission operations activities are implemented on the larger space pro- 
grams, mockups are usually constructed for programs of average cost and complexity. 

Several uses of mockups are: 

(1) Reviewing and assuring the incorporation of adequate human engineering, serviceability, 
and safety criteria 

(2) Checking out preliminary operational and maintenance procedures for clarity and ac- 
curacy of presentation 

(3) Recommending revisions to the foregoing procedures if they permit task overloading or 
underloading or hazards involving man or equipment 

PARTICIPATION IN PRERELEASE DESIGN REVIEWS 

The prerelease design review is the project decision point preceding the transition to the 
fabrication of flight-type hardware. At this point, the detailed design is fixed and specifications 
are essentially complete. (See ref. 15.) At this time, the role of those responsible for the hu- 
man factors area involves a review of the design package in order to assure that appropriate 
features have been provided to facilitate operation and servicing of the hardware. This review 
should make use of human engineering design criteria available from a number of sources (refs. 

8, 9, 11, and 12); criteria and checklists for maintenance and serviceability features should also 
be used (see refs. 8 and 16 to 19 and tables IV and V in chapter 3 of the present publication). The 
results of this review of the design package should be reported in the design review meeting. The 
report should identify and make recommendations for correction of significantly undesirable or 
deficient human engineering or serviceability features. 
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FABRICATION AND FLIGHT HARDWARE TEST ACTIVITIES 

The fabrication and flight hardware test stage of the project life cycle includes all activities 
following design and development testing but preceding activities at the launch site. It includes 
manufacture, assembly, inspection, in-process tests, qualification and flight acceptance testing 
(component level), subsystem and systems testing, and transportation of the system article to the 
launch facility. Throughout these activities, attention must be devoted to prevention of human 
errors and to correcting any that do occur. Although the prevention function on smaller programs 
is frequently not separated and formally identified as human engineering effort, careful considera- 
tion of various measures to prevent human error is an inherent part of the planning for all the ac- 
tivities in the fabrication and flight hardware test stage. 5 The correction function, on the other 
hand, is more centralized and on both large and small programs is usually approached through the 
discrepancy and trouble-reporting system(s) which the project uses. 

HUMAN ERROR INVESTIGATION AND ANALYSIS 

In order to correct and prevent recurrence of human errors and human-induced failures, it 
is necessary to study discrepancies which have occurred in production, assembly, handling, and 
test operations and to identify and characterize the specific human factors contributing to them. 
This may be accomplished by: 

(1) An investigation of personnel process and workmanship errors which are critical or 
hazardous to system operation 

(2) The reviewing of recurring workmanship errors which, though not critical as single 
events, may reflect basic deficiencies in design, procedures, or manufacturing con- 
ditions and thus contribute to mission degradation or failure potential 

(3) An investigation of testing and test procedural errors (on all space programs) 

Particular attention must be given to all errors of a critical nature and to those of less critical 
nature which pose potential problems by their frequent occurrence. 

An essential prerequisite for accomplishing the foregoing activities is an effectively imple- 
mented discrepancy or trouble reporting system. (See also ref. 22, par. 14.3.) Reports in the 
system must be written on a current basis by manufacturing, test, engineering, or inspection 
personnel following the detection of an equipment or operational discrepancy. Although the re- 
ports are chiefly concerned with equipment failures and deviations from specified performance, 
they also identify such human errors as: 

(1) Use of improper tools 

(2) Inadequate handling 

(3) Installation of wrong items 

(4) Failure to make the proper connections 

(5) Failure to follow instructions, drawings, or test procedures 

(6) Failure to provide required items (such as tooling, test equipment, or protective equip- 
ment) for manufacturing, test operations, etc. 

OBSERVATIONAL STUDIES 

A second important step following detection and recording of human errors involves investi- 
gation to obtain additional information on basic causes or original sources. These kinds of data. 


References 20 and 21 describe some methods of preventing human errors in inspection ac- 
tivities. 
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rarely included on trouble reports, may be obtained either by (1) interviewing and obtaining in- 
formation from supervisory, inspection, and operator personnel involved, or by (2) performing 
observational studies of specific fabrication, assembly, and test operations where human errors 
are suspected of being of a critical type or have been occurring with a significant frequency. 

An example of human factor followup on failure reports involves a case in which a series of 
these reports showed repeated instances of damage to the same diode (CR-12) of a direct-current 
power supply but gave vague descriptions of failure cause. An investigation to determine the 
cause of these repeated failures disclosed that accessibility to the diode for subassembly checkout 
was limited. Immediately adjacent to diode CR-12 were two 16-gage wires terminated on one 
post, although the hole on the post was designed for only one 16-gage wire. This resulted in the 
wires being wrapped around the post during initial assembly, which further complicated acces- 
sibility to the diode . The reported failures all involved separation of the anode from the body 
portion of diode CR-12, which was caused by personnel pushing the diode aside to gain access 
during maintenance and checkout activities. After this discovery of true failure cause, correc- 
tion by redesign to provide adequate accessibility in this OGE system was a relatively simple 
matter. 


PRELAUNCH AND OPERATIONAL ACTIVITIES 

The phase covering prelaunch and operational activities begins with preflight assembly and 
checkout at the launch facility and extends through completion of the mission. Major human engi- 
neering and serviceability functions in this project phase are concerned with assuring human per- 
formance by observing and reviewing both (1) flight test procedures of manned spacecraft and 
complex unmanned vehicles (including document review and observation of "dry" test runs), and 

(2) maintenance operations involving both spacecraft and operational ground equipment. 

The activities described here are of particular importance to all programs. Although the use 
of human engineering specialists for them may be limited to programs of high national signifi- 
cance, these activities must be conducted diligently on other programs also, usually by test engi- 
neering or quality assurance personnel. 

The following representative activities are applicable during critical flight test and mainte- 
nance operations: 

(1) Observing the implementation of specific test, maintenance, and support procedures to 
determine which equipment features are unsafe or inconsistent with realistically ex- 
pected human effort or capability 

(2) Identifying deviations and difficulties in test or maintenance procedure documents which 
could lead to human error in task performance 

(3) Reviewing accessibility and reliability features (especially during initial installation of 
test equipment and facilities) to assure that equipment can be inspected, adjusted, and 
repaired with minimum man-hours, experience, and support equipment 

(4) Revising personnel work space arrangements and operating configurations for more ef- 
fective performance 

(5) Recommending changes in working environment where necessary in order to provide 
safe and reliable launch operations and facilities 

(6) Reviewing all failure and trouble reports generated during these activities to assess and 
correct human error problems 

As project activity progresses, frequent changes usually occur which make necessary a con- 
tinual updating of test and operating procedures. Throughout this process, adequate attention 
should be given to eliminating potential sources of human error, particularly when the changes are 
part of the corrective action following reported failures or discrepancies. 
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PERSONNEL QUALIFICATIONS, TRAINING, AND MOTIVATION FOR ALL PHASES 

Important human- factor areas, the detailed treatment of which is outside the scope of this 
publication, include selection, training, supervision, and motivation of personnel. Problems in 
these areas are damaging at any phase of project life but can become especially acute from the 
beginning of fabrication through mission completion. It should be borne in mind that much of what 
is gained by sound effort in all other phases of project activity can be negated by inadequate atten- 
tion to these factors. 
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CHAPTER 3 

Specific Application to an Unmanned Satellite System 
(the Micrometeoroid Deep Space Satellite) 


Chapter 2 has described a method for categorizing space projects by size and significance and 
then selecting human engineering activities (table II) to fit each category. It has also given a gen- 
eral description of each of the human engineering activities listed in table II. The present chapter 
describes the application of that general guidance to a specific project. The system chosen for the 
illustration is a hypothetical cislunar Micrometeoroid Deep Space Satellite (MDSS), a concept 
based on studies of an unmanned satellite program of medium-to- small cost and complexity. 

The primary mission objective of the MDSS is to obtain information on micrometeoroid pene- 
tration rate variation with distance from the Earth. A long-life, high-reliability spacecraft hav- 
ing a number of state-of-the-art sensors with similar or overlapping sampling windows was 
recommended for accomplishing this goal. (See fig. 1 and ref. 23.) After extensive study, the 
Atlas-Agena D launch vehicle was also selected to place the spacecraft in a highly elliptical orbit 
for a period of 6 to 12 months. This MDSS and its associated operational ground equipment sys- 
tems will provide the framework for describing a small projects program of activities for elimi- 
nating sources of human error. As a practical matter, the illustration here will not consider 
human engineering activities associated with launch vehicle development, since a spacecraft pro- 
gram of this type treats the launch vehicle as a "shelf item" except in its testing and operating 
interfaces with the spacecraft. 

MDSS PREDESIGN AND EARLY DESIGN ACTIVITIES 

In order to select appropriate activities for this program, first refer to table I and note that 
the spacecraft falls in category C and the operational ground equipment (OGE) falls in category H. 
(The interfacing of spacecraft and launch vehicle will be considered as an area of spacecraft de- 
velopment and test.) Next, in order to determine predesign and early design activities, refer to 
table n which recommends the following activities: 

(1) Review system requirements and analyze mission; use an intermediate level of effort for 
spacecraft and full effort for OGE 

(2) Allocate functions by man- machine analysis; use an intermediate level of effort for both 
spacecraft and OGE 

(3) Prepare operator task analyses; use intermediate effort for the OGE only 

(4) Human engineering of displays, controls, etc.; use intermediate effort for the OGE only 

(5) Prepare serviceability and maintainability analyses; use full effort for both spacecraft 
and OGE 

(6) Participate in system and subsystem design reviews and design trade-offs; use inter- 
mediate effort for both spacecraft and OGE 
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Figure 1.— Preliminary configuration concept for MDSS (ref. 23). 


The implementation of these functions for this program is described in the following para- 
graphs. 


REVIEW OF REQUIREMENTS AND PREPARATION OF FUNCTION ANALYSES 


Review of Requirements 


The first step in determining personnel activities on the MDSS is the identification of the 
functions of the system and its mission. This involves a review of requirements, followed by the 
preparation of function analyses and derivation of specific man- machine functions. 

MDSS system requirements data are obtained from: 

(1) Conceptual study reports 

(2) Customer requests for proposals, the preproposals, and the actual proposals 

(3) Documents describing unmanned satellite concepts similar to the MDSS 

(4) Information received through project or customer personnel interviews or corre- 
spondence 

From the foregoing sources, the following representative requirements are listed for both 
the spacecraft and its OGE. The MDSS spacecraft requirements are: 
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(1) Determine micrometeoroid penetration rate variation with distance from Earth 

(2) Obtain and relay information on impact rate variation with distance from Earth 

(3) Collect and communicate information on mass distribution in the same environment 

(4) Determine and send data on velocity distribution in the same environment 
The MDSS OGE requirements are: 

(1) Provide for command control of the spacecraft, both hardline and RF, to exercise it 
through all operational modes 

(2) Provide capability for calibration and checkout of each spacecraft subsystem to insure 
performance to specifications 

(3) Provide external power source to the spacecraft simulating spacecraft power, and pro- 
vide monitoring, switching, and charging of spacecraft supplies 

(4) Provide electrical simulation of the micrometeoroid environment as a primary stimulus, 
and provide stimuli for other spacecraft sensors 

(5) Provide for reception and decommutation of all telemetry data 

(6) Provide mobility of checkout equipment to assure ease of transport between test areas 

(7) Provide for mechanical handling and transportation of the spacecraft 


Preparation of Function Analyses 


The next step is the determination of the system functions 6 or capabilities needed to meet the 
foregoing listed requirements. Typical functions for the MDSS system include; 

(1) Accumulating micrometeoroid penetration data through the use of counters 

(2) Sensing and transmitting primary data by telemetry 

(3) Using an impact simulator to check out spacecraft capacitance panels 

(4) Using an established range and range rate tracking system to track the spacecraft 

(5) Receiving and displaying all signal data including quick-look diagnostic and scientific 
measurements 

(6) Using checkout equipment to pinpoint faults down to the replaceable component level 

(7) Monitoring of specific spacecraft parameters, such as RF power output and spectrum of 
spacecraft transmitters 

(8) Positioning operational ground equipment vans in accessible positions for launching the 
MDSS 

(9) Recording and storing transmitted data by using a magnetic tape recorder as the prime 
recording medium 

The above general MDSS functions, and others determined during system definition phases, 
provide the basic data for preparing function analyses, also known as man- machine analyses. 

Reviewing mission requirements and specifically identifying system functions are essential 
steps in the basic planning of the whole design and development effort. They are shown here to 
illustrate their use in preparing man-machine analyses. 
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These analyses are generated on subsystems requiring man in their operation, test, or mainte- 
nance. According to table II, only intermediate effort is recommended in this area for the MDSS. 
That effort should be applied to the following systems: 


(1) Onboard spacecraft electronic and electrical equipment 

(2) Command control, instrumentation, telecommunications, data handling, and associated 
OGE equipment systems (all housed in a mobile van) 


In order to perform man-machine analyses, a table is usually constructed which shows each 
function, the specific requirements which apply to it, and an allocation of which parts of the func- 
tion are to be performed by man and which by machine. Exhibit 2 shows such a table applicable 
to the MDSS OGE function of data recording. It may be considered a typical example useful for 
analyzing other functions involving man in unmanned satellite activities. 

The allocation of functions requires (1) an examination of the possible appropriate combina- 
tions of man-machine capabilities for achieving the system functions and then (2) selecting those 
combinations most likely to achieve maximum system effectiveness. 

Selection of the best possible combination of man-machine capabilities for the MDSS is of 
necessity a series of approximations. The first approximations are made with reference to the 
various functions listed at the start of this section. For example, "the MDSS will be tracked using 
the NASA Range and Range Rate tracking system with an active transponder in the spacecraft." In 
this case, a final approximation of the best combination of capabilities will be made only after 
project management finally agrees on the most suitable mode for tracking the spacecraft. 

The foregoing approximation approach was used in assigning the following MDSS functions to 
human operators : 

(1) Interpretation of telemetered micrometeoroid penetration data (obtained from overall 
data collecting and processing activities) 

(2) Decision making (as in maintenance activities) 

(3) Handling unexpected occurrences (such as detecting deviations from required orbit and 
programming flight path corrections) 

(4) Controlling and monitoring equipment performance (as in ground- station handling and 
monitoring of primary data transmission from the spacecraft) 

Typically, this allocation of operator functions was governed by consideration of man- 
machine capabilities weighed in a trade-off with the factors of: 

(1) Equipment availability 

(2) Economy 

(3) Simplicity of operation 

(4) Reliability 

(5) Mobility of ground equipment 

( 6) Maintainability 
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System 

function 

Data 

recording 


Requirement 

Function a 

illocation 


Machine 

Man 

1. Spacecraft telemetry data will 
be received by one ground 
station. Orbit period is 6 
days. Minimum daily visi- 
bility is 3 hours. Recorded 
data for 24 hrs must read 
out in 60 min maximum. 

Ground recording must accom- 
modate spacecraft readout. 
Spacecraft will have two- 
channel recorder. One will 
record commutated engineering 
data on status of spacecraft 
functions; the other will record 
continuous data on microme- 

Personnel will determine from 
tracking and inquiry signals 
when to command readout. 
Readout and recording devices 
will be started at appropriate 
time. 

Initiate readout, select readout 

2. Onboard recording of micro- 
meteoroid data must be 
continuous (minimum inter- 
ruption for readout) and 
recording of spacecraft data 
must be at frequent intervals 
(3 min maximum, except 
during readout). 

teorite impacts. Both recorder 
channels will be readout 
through a single telemetry 
channel. 

speed, switch back to ’’record- 
ing" mode. 

3. Record raw and processed 
telemetry data on ground. 

Record incoming raw data as re- 
ceived on electromagnetic tape. 

Turn recorders on and off. In- 
sert blank reels of tape. Re- 
move and store filled reels of 
tape. 

4. Record with minimum reli- 
ance on man during critical 
periods. 

Use two main recorders. Initiate 
No. 1 manually 5 min before 
start of readout. Initiate No. 2 
automatically 7 min before No. 

1 exhausts tape. 

Set up and check condition of re- 
corders prior to each readout 
period. Start recorders at ap- 
propriate time prior to data 
reception. 

5. Provide maximum practicable 
assurance in ground record- 
ing system against loss of 
raw telemetered data. 

See above. Recorders No. 1 and 
2 automatically overlap. Have 
recorder No. 3 on standby. 

Monitor recorder operation dur- 
ing readin. Switch to standby 
recorder if main recorders are 
detected to operate incorrectly. 

6. Provide visual record in real 
time during readout of 10 
most vital engineering func- 
tion parameters to permit 
assessment and compensa- 
tion for possible spacecraft 
malfunction. 

Decommutate 10 vital spacecraft 
parameters and display on strip 
chart recorder or other device 
in real readout time. 

Monitor vital parameters and give 
appropriate commands to space- 
craft in event of spacecraft mal- 
function. 

After satisfactory readout, initiate 
command to switch spacecraft 
back to ’’recording” mode. 

7. Make permanent visual rec- 
ord of all telemetered pa- 
rameters. Each parameter 
must be recorded separately 
on a calibrated time base. 

Use onboard clock to feed five- 
min interval signals onto on- 
board data tapes. 

Feed data on orbital coordi- 
nates, date, and Z time onto 
raw data tape at ground 
telemetry station. 

Decommutate engineering data 
and make separate printouts of 
engineering parameters. Auto- 
matically add position and time 
data to each printout. 

Use and store visual records. 
Store raw data tapes. 


Exhibit 2.— Typical man-machine function analysis format. 
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These factors are important not only in generating initial MDSS function analyses and allo- 
cations but also in updating these materials during the latter phases of system development. 


PREPARATION OF OPERATOR TASK ANALYSES 

When the development of man-machine function analyses is accomplished, attention is di- 
rected to deriving personnel tasks from them. Reference to table II indicates task analyses 
should be prepared at an intermediate level of effort, and only for those MDSS systems (OGE 
systems in this case) specifically involving human performance requirements and behavior. 

The task analysis effort results in a description of the activity of a man while he interacts 
with a major equipment unit in performing activities. Human behaviors are identified and de- 
scribed, with further detail added as more data on OGE equipment and personnel are obtained 
throughout the design phase. An example 7 of a task analysis for a programmed MDSS operational 
ground equipment activity is presented as exhibit 3. (See refs. 24 and 25 for more comprehensive 
descriptions of task analysis techniques.) 

HUMAN ENGINEERING OF DISPLAYS , CONTROLS, AND OTHER EQUIPMENT FEATURES 

Information from the foregoing task analyses is especially of value in the human engineering 
of the operational ground equipment to be operated by MDSS personnel. The OGE for the MDSS is 
of the checkout type, mounted in standard racks and located in a transportable van. Racks can be 
classified according to their functional usage as: 

(1) Command control rack 

(2) Power control and monitor rack 

(3) Signal handling rack 

(4) PCM decommutation rack 

(5) Tape recorder rack 

(6) Strip chart recorder rack 

Human factors inputs for these major components are concerned with displays, controls, 
panels, chassis, and other associated equipment in basic operational configurations. These in- 
puts are derived from human engineering principles and design criteria, which are supported 
primarily by empirical studies and logical, long-standing usage. (Ref. 11 presents a complete 
description and evaluation of design criteria for a number of human engineering areas.) 


PREPARATION OF SERVICEABILITY AND MAINTAINABILITY ANALYSES 

Following the guidance of table II, note that the serviceability and maintainability analysis 
area requires full effort in application of human engineering considerations to the MDSS project. 
These analyses apply to both the spacecraft and the OGE. The objective is to review the design 
to detect features which might make maintenance and service operations difficult or which provide 
unnecessary opportunities for misuse or equipment damage. It is desirable to conduct this re- 
view in conjunction with other human engineering design efforts (such as that described in the 
preceding section for the MDSS OGE) if the hardware in question calls for it. 


7 This format is directly applicable for analyzing tasks on equipment similar to the MDSS 
OGE. 
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Exhibit 3.— Preliminary task analysis of an MDSS OGE activity. 
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Serviceability and maintainability analyses are best implemented with the aid of qualitative 
checklists and formats. These are available from a number of sources such as references 17 
and 26 for the OGE and references 18 and 19 for any type of equipment. 

Table IV presents a checklist of serviceability criteria for the MDSS spacecraft, spe- 
cifically the modules housing critical electrical and/or electronic equipment. These criteria 
provide for adequate accessibility and for other design features which will substantially reduce 
chances for human error in operations. Additional checklists for racks and chassis comprising 
the larger portion of the MDSS OGE may be found in table V. Tables IV and V should be used in 
early design, first by the equipment design engineers and later by those engineers responsible for 
reviewing the design to assure that it is adequately serviceable. 

PARTICIPATION IN PRELIMINARY DESIGN REVIEWS 

The human engineering effort described in the two immediately preceding sections constitute 
the majority of human factors activities required during the MDSS design phase. The one impor- 
tant effort remaining involves participation in preliminary system and subsystem design reviews 
planned for unmanned satellite programs of the MDSS type. The purpose of applying attention to 
human engineering areas in these reviews is to assure that initial concepts and design require- 
ments are reevaluated against current state-of-the-art information and updated mission require- 
ments. 

Human factors engineering at the preliminary design review is focused on determining if 
previously identified manned activities will adequately and reliably satisfy system and subsystem 
requirements. Special attention should be directed to the man- machine functions allocated for 
MDSS system operations. (See section entitled "Preparation of Function Analyses.") Questions to be 
considered in reviewing input documentation or, if necessary, to be asked in the review meeting are: 

(1) Have any initial MDSS system or subsystem requirements been neglected in assessing 
and recording human capabilities for satisfying them? 

(2) Have any recent or revised requirements been overlooked in the MDSS analyses pre- 
viously conducted ? 

(3) Does the proposed MDSS design configuration and function allocation take full advantage 
of combined man-machine capabilities (as in determining which functions will be manual, 
which automated, and which semiautomated) ? 

(4) Have functions been assigned to MDSS equipment which lead to deficient operation, and 
can humans perform the same functions more effectively (or is the reverse true) ? 

(5) Are MDSS function analysis reports satisfactory as basic data for follow-on human engi- 
neering efforts ? 

(6) Does the design incorporate preventive features, which respond to human factors trouble 
experience from similar equipment ? 

Recommendations and results from preliminary MDSS design reviews will serve as impor- 
tant input material for succeeding (prerelease) design reviews. 

MDSS DEVELOPMENT AND PROTOTYPE TEST ACTIVITIES 

In the development and test activities, the human engineering efforts applicable to the MDSS 
system, as determined from table II, are: 

(1) Monitor the incorporation of human engineering and serviceability criteria in design of 
spacecraft and OGE— intermediate effort 

(2) Prepare personnel requirements data for OGE— intermediate effort 

(3) Assist in the development of operational and maintenance procedures for spacecraft and 
OGE -full effort 
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Table IV.— Serviceability and Maintainability Criteria for Modules in MDSS Spacecraft 

A. Accessibility 

1. Modules quickly and easily removed and replaced without damaging other adjacent 
components 

2. Module replacement on individual basis (not requiring removal or disconnection 
of other modules) 

3. Module parts requiring most frequent access in the most accessible locations 

B. Handling considerations 

1. Mounted so that parts can be easily inspected, checked, replaced 

2. Units provided with grips for one-man carrying (if weight is 10 to 45 lb) 

3. Grips at least 4-1/2 in. wide by 2 in. deep 

4. Lifting eyes (suitably labeled) on units weighing in excess of 90 lb 

5. Provide modules with rests for servicing where feasible 

6. Provide for easy removal of irregular or fragile extensions (such as wave 
guides, cables, and hoses) to facilitate handling 

7. Where feasible, cabling long enough to permit checkout of module while part of 
system 

8. Replacement cables with easily accessible connector at each end are desirable 

9. Provide adjacent units with different types of connectors to prevent misconnection 

C. Ease of adjustment and repair 

1. No tool requirements other than for required adjustments or where remove-and- 
replace fasteners require commonly available tools 

2. Control adjustments should be located on module face with positive covers to 
prevent accidental disturbing 

3. Displays should indicate malfunctions to level of remove-and-replace components 

4. Modular connectors reliable and capable of quick disconnect 

5. Minimum of fasteners required for installation 

6. Modules sufficiently uniform for direct interchangeability without adjustment 

D. Ease of identification 

1. Modules labeled and coded to indicate correct unit for replacement 

2. Highly similar units keyed to prevent insertion of wrong units 
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Table V.— Serviceability and Maintainability Criteria for 
Racks and Chassis in MDSS OGE 

A. Handling considerations 

1. Mounted on slide and/or revolving hardware so that parts can be easily inspected, 
checked, and replaced 

2. Chassis provided with grips for one-man carrying (if weight is 10 to 45 lb) 

3. Chassis provided with grips for two- man carrying (if weight is 46 to 90 lb) 

4. Grips at least 4-1/2 in. wide and 2 in. deep 

5. Lifting eyes (suitably labeled) on equipment weighing in excess of 90 lb 

6. Rests or stands should be part of chassis or rack where feasible 

7. Provide for easy removal of irregular or fragile extensions (such as wave 
guides, cables, and hoses) to facilitate handling 

8. Provide cabling long enough to permit checkout of chassis while part of system 

9. Provide replaceable cables with easily accessible connector at each end 

10. Provide adjacent items with different types of connectors to prevent misconnec- 
tion 

11. Cabling out of the way and not likely to be pinched by doors, lids, etc., walked- 
on, used for hand-holds, or bent around sharp corners 

12. Cabling removable and replaceable without removing other parts 

B. Ease of identification 

1. Chassis permanently and clearly labeled with information required to relate it to 
system 

2. Test points provided on chassis exterior 

3. Lubrication points labeled and accessible 

4. Test points labeled with signal values, wave shapes, etc. (when space is avail- 
able) 

5. Primary test points located and coded so as to be readily distinguishable from 
secondary test points 

C. Ease of adjustment and repair 

1. Removable assemblies and units generally replaceable with common hand tools 
and removable without damaging adjacent units 

2. Need for special tools minimized; required special tools secured to equipment 
near point of use 

3. Schematics and instructions attached to or adjacent to chassis 

4. Mechanical guides provided for screwdriver adjustments without the aid of 
vision 
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Table V.— Serviceability and Maintainability Criteria for 
Racks and Chassis in MDSS OGE (Continued) 

C. Ease of adjustment and repair (continued) 

5. Chassis parts arranged in family groups with outlining of groups by painted bor- 
ders, etc. 

6. Self-checking features (built-in meters, warning indicators) provided 

7. Sensitive adjustment points appropriately located and guarded 

8. Test-point panels provided and labeled with clear instructions 

9. Primary test points grouped in a line or matrix reflecting sequence of tests to 
be made 

10. Calibration instructions logically integrated with calibration controls 

11. Transmission line terminals marked with appropriate line impedance 

12. Lamps replaceable from the front 

13. Chassis capable of being locked in both open and closed positions 

14. No termination of test cables on control and display front panels 

D. General considerations (including safety) 

1. Drawers and racks designed so that they operate with a force of less than 40 lb 

2. Guards and shields provided to prevent damage to delicate or sensitive parts 
during movement 

3. Limit stops, guards, and/or retaining devices provided as part of basic chassis 
(but stops may be overridden for assembly removal) 

4. Guide pins or their equivalent incorporated on units to assist in alinement during 
mounting, especially on modules that contain or function as connectors 

5. Racks and drawers arranged so that minimal place-to-place movement occurs 
during checkout 

6. All external metal parts at ground potential 

7. No hot leads exposed by disconnected* connectors and plugs 

8. Interlocks and warning indicators provided where potentials exceed 70 volts 

9. Contacts, terminals, etc. with potentials more than 70 volts rms provided with 
guards or barriers; voltage level prominently displayed 

10. Operation of switches or controls initiating hazardous operations based on prior 
operation of a related or locking control 

11. Conspicuous placards mounted adjacent to high voltage equipment, equipment 
extremely hot, etc. 

12. Avoidance of M tapped through" holes which allow use of wrong length screws 

13. Care exercised in fusing, soldering, and flux removal operations to prevent 
damage to (or unsoldering of) adjacent parts or areas 

14. Edges and corners rounded or finished to prevent injury 
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(4) Participate in mockup activities for spacecraft and OGE— intermediate effort 

(5) Participate in prerelease design reviews for spacecraft and OGE— intermediate effort 

MONITORING THE INCORPORATION OF CRITERIA 

During MDSS design, human engineering efforts were concerned with determining prelimi- 
nary human performance requirements and with providing serviceability inputs to equipment de- 
sign. Now, as the MDSS goes into development and testing, a two-fold followup activity is con- 
ducted. (In the MDSS case, the effort should be performed at a relatively low manning level by 
project personnel who are assigned human engineering responsibility but who are usually not 
specialists in the area.) The two- fold activity is as follows: (1) The design and the prototype 
hardware are reviewed to assure that earlier recommended design features are incorporated; and 

(2) these earlier recommendations, and the analyses underlying them, are revised as appropriate 
to keep pace with refinements in design and with added data received through testing. 

DEVELOPMENT OF OPERATIONAL AND MAINTENANCE PROCEDURES 

Throughout the development test phase, the human engineering activity should place heavy 
emphasis on assisting project personnel responsible for developing the procedures for testing, 
checking- out, and maintaining the MDSS. The primary effort will be devoted to reviewing these 
procedures to assure that they are as complete and as "error- minimal" as possible. 

Procedure Character! sties 

Throughout procedure development, preliminary drafts of MDSS instructional and procedural 
documents are reviewed for such characteristics as: 

(1) Clarity and conciseness in describing test and maintenance activities step-by-step (state- 
ments having potential ambiguity should be deleted or revised) 

(2) Appropriate use of abbreviations and caution statements (see table VI) 

(3) Indications of the time for performing a specific operation 

(4) Completeness, in including all information necessary to do the job (e.g., what readings 
should be obtained, what are the tolerance limits, and what should be done if out-of- 
tolerance conditions arise) 

(5) Use of illustrative material (tables, figures, charts, etc.) only where necessary to 
clarify and complement procedural steps 


Table VI.— Items for Evaluating Caution and Abbreviation 
Usage in MDSS Procedures (ref. 27) 


Caution usage 

Abbreviation usage 

Used sparingly as is consistent with real 
need 

Used for operating procedures, practices, 
etc. which, if not strictly observed, will 
result in damage to, or destruction of, 
equipment 

Generally precede the applicable text 

Used when space may be saved 
Held to a practicable minimum con- 
sistent with clear presentation 
Defined, if uncommon, in the introduc- 
tion of each document 
Not used where there is any doubt as to 
what is abbreviated 

Only the most commonly used terms are 
abbreviated, e.g., units of measure- 
ment and compass direction 
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(6) Inclusion of provisions for meeting contingencies or problems outside of normal job 
operations (what to do if a required reading is not obtained, how to respond to unexpected 
power loss, etc.) 

(7) Consistency of procedures used in preflight activities with those to be followed in opera- 
tional use 

An illustration of a test procedure possessing the above preferred items is given as example 
B of exhibit 4. This exhibit contrasts two sets of procedures, A and B. Both were written as 
instructions for making the same connections to launch vehicle engine components prior to a 
pressure switch checkout. The differences between the "bad" procedure (example A) and the 
"good" procedure (example B) for doing the same tasks are evident when they are reviewed for 
clarity, completeness, accuracy, and other worthwhile features. 

Another example of an inadequate operating procedure for checking a propellant system's 
flow rates and pressures is shown as exhibit 5. Although the procedure appears to be complete 
and explicit in stating what pressure and flow rate readings and recordings are to be made, it has 
the following flaws which are likely to cause human error: 

(1) It calls for the recording of three different readings of chamber pressure in step c. The 
"transducer readout" value is specifically indicated in psia. However, step b requires 
the operator to set the chamber pressure to a stated value expressed in psig, but labeled 
"transducer reading." It further complicates the picture by adding a note which advises 
that the transducer reads absolute pressure. If it is assumed that the note is correct, 
step b should call for setting chamber pressure to 182±5 psia as read out directly from 
the transducer and not 170±5 psig. 

(2) In step b the operator is instructed to set the chamber pressure within specified limits 
(170±5 psig) by operating the back-pressure valve. However, the operator is not told 
what he should do if he is unable to control the pressure within the limits by means of 
the back-pressure valve (possible alternatives may be to call the supervisor, shut down 
the system, perform certain diagnostic actions, etc.). 


Updating of Procedures 

It will be necessary to stay abreast of frequent changes to MDSS development test require- 
ments by continually updating the system's test and operating procedures. Particular attention 
should be paid to incorporating corrective actions and revisions to test procedures promptly after 
the detection and reporting of discrepancies (especially those caused by human error). Correc- 
tions to procedures may be included, for example, in the form of an added or modified job step or 
as a caution or warning notice inserted in the text. These corrections should be made available 
to operating personnel promptly and such personnel should be required to familiarize themselves 
with the revised procedures prior to the start of the test concerned (and preferably on a daily 
basis). 


PARTICIPATION IN LOCKUP ACTIVITIES 

In the development phase, an intermediate level of human engineering effort would be devoted 
to mockup activities for the MDSS. This effort would primarily consist of inspecting the avail- 
able spacecraft mockup 8 for possible human factors problems. Such equipment would especially 


8 A system of this type would usually build spacecraft mockups primarily for such purposes as 
determining fit of subassemblies, center of gravity, and cabling runs. 


Example A— faulty set 


Example B— preferred set 


Step T.P. No. 739-2 

7.0 EFFECTING OF TEST SET AND 
ADAPTER BOX CONNECTIONS 


7.1 Insure that all switches on test set 
and adapter box, and also all valve 
regulators on the aforementioned 
equipment are in an off or closed 
position 

7.2 Insure that power cable is dis- 
connected prior to disconnecting 
and/or connecting conn’s to AGE 
or hdware. 

7.3 Connect 285516 Cable from 
28660-14 A. B. in the following 
way: Connect the 66P8 Conn, to 
T. S. 66J 8 Recep. and then con- 
nect the P2 Conn, to A. B. J4 
Recep. before connecting the 
270419 cable 

7.4 Connect 270418 cable as follows: 
Connect the P5 Conn, to A. B. J6 
Recep. and then remove l.v. 
conn’s from interface EL 1400 J7 
and EL 1400 J8 Recep ’s; connect 
Pll and P12 to engine interfaces 
EL1400 Jll and J12, respectively. 


Time (approx.) for entire opera- 
tion 


Step T.P. No. 739-2 

7.0 TEST SET AND ADAPTER BOX 
CONNECTIONS 

Task Started Time Date 

7.1 Insure all switches on test set and 
adapter box are in OFF or CLOSED 
position 

7.2 Insure all valves and regulators on 
test set and adapter box are in OFF 
or CLOSED position 

7.3 Insure that facility power cable is 
disconnected from AGE prior to dis- 
connecting and/or connecting electri- 
cal connectors to AGE or engine 
hardware 

7.4 Insure vehicle IPS and APS power 
supplies are OFF during disconnec- 
tion and connection of launch vehicle 
connectors at engine interface 

7.5 Connect 285516 Cable (obtained from 
285350-16 Adapter Box Intercon- 
necting Kit) from 28660-14 adapter 
box as follows: 

.5.1 Connect 66P8 connector to test set 
66J 8 Receptacle 

.5.2 Connect P2 Connector to adapter box 
J4 Receptacle 

7.6 Connect 270418 Cable as follows: 

.6.1 Connect P5 Connector to adapter box 

J5 Receptacle 

CAUTION 

Do not connect any cable connectors 
to engine interfaces until all launch 
vehicle connectors have been removed 
from engine interfaces. 

.6.2 Remove launch vehicle connectors 
from engine interface EL1400J7 and 
EL1400J8 Receptacles 

.6.3 Install protective closures or connectors 

.6.4 Connect Pll Connector to engine inter- 
face EL140GJ11 Receptacle 

.6.5 Connect P12 Connector to engine inter- 
face EL1400J12 Receptacle 

Task Completed Time Date 


a Omits important step after 7.2 in assuring vehicle power supplies are off . 
No caution note or quality control (QC) check included in this example. 


Exhibit 4.— Comparison of test procedures for performing 
same operations to connect test equipment to a launch vehicle. 
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FLCW TEST PROCEDURE - STEADY STATE 

a. Set TV driver at 0 ma. 

b. Actuate SOV, With solvents flowing, confirm that 
TV inlet pressures meet specified requirements. 

Set hack pressure valve to produce a chamber pressure 
of 170 ±5 psig (transducer reading.) 

NOTE 

The Pch transducer is calibrated to read 
absolute pressure; hence, indicated pressure 
will be 170 psig plus barometric pressure 
(approx. 12 psi) or 182 psia. DVM reading is 
1.82V. 

c. Read and record the following steady state data: 0 ma 


Oxidizer flowrate 
Fuel flowrate 
Ox TV inlet pressure 
Ox TV inlet pressure 
Fuel TV inlet pressure 
Chamber pressure: 

Transducer readout 
Barom. press. 

Gage press. 

Back pressure gage reading 


cps ( lb/sec) 

cps ( lb/sec) 

cps ( lb/sec) 

psig 

psig 

psia 

psi 

psig 

psig 


d. De -activate SOV. Proceed to next data point. 


Exhibit 5.— Example of faulty flow test procedure. Step b is confusing because the 
transducer reading appears directly as psia, not psig; also, step b 
does not tell the operator what to do if he cannot adjust chamber pres- 
sure to the specified limits by means of the valve. 
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be evaluated for the inclusion of desirable design criteria preventing human error in assembly, 
test, and serviceability functions. (See table V.) Human engineering design changes resulting 
from these mockup inspections would be incorporated during continuing development testing. 

PARTICIPATION IN PRERELEASE DESIGN REVIEWS 

Prerelease design reviews occur just prior to the release of engineering drawings for manu- 
facturing. For the MDSS, table II recommends an intermediate level of human engineering par- 
ticipation in these reviews to uncover problem areas. 

Project personnel responsible for reviewing MDSS designs should especially pay attention to 
those features related to the ease with which equipment can be operated and serviced. Informa- 
tion obtained from preliminary design reviews should be used in checking for the incorporation of 
such items as: 

(1) Adequate and safe arrangement and accessibility 

(2) Coding and labeling (including schematics) 

(3) Adequate cable and line routing 

(4) Provision of test points 

(5) Appropriate fasteners and connectors 

(6) Ease of assembly, adjustment, and calibration 

(7) Ease of handling (packaging, weight considerations, etc.) 

(8) General safety provisions (for prevention of personnel hazards and/or equipment damage) 

(9) Avoidance of blind- mating of connectors or tubing 

Tables IV and V should also be used as backup checklists during prerelease reviews to detect 
potential maintenance problems and sources of human- induced failures. (Refs. 16 to 19 and 28 
provide added serviceability and maintainability data and guidelines for those working on systems 
similar to the MDSS.) 

For MDSS OGE specifically, the design review should also cover examination to detect po- 
tential causes of human error in operating the equipment. This should result in eliminating 
features 9 that: 

(1) Violate "populational stereotypes,” or the usual way of doing things (e.g., flipping a 
toggle switch "down” to turn on an MDSS recorder) 

(2) Impose performance requirements in excess of user capability (e.g., too many displays 
to be monitored on the PCM decommutation rack at one time, or one display which com- 
bines too many kinds of information) 

(3) Provide inadequate information or facilities for the user (e. g. , displays hard to read, or 
coded in the wrong format; schematics for adjustment and calibration not attached to cer- 
tain OGE electronic equipment) 

(4) Contribute to unnecessarily difficult, fatiguing, or hazardous conditions (e.g., inadequate 
illumination and intolerable noise levels during mobile van test operations, or location of 
internal controls too closely to dangerous voltages) 

MDSS FABRICATION THROUGH OPERATIONAL USE 

A final reference to table II indicates that for the MDSS and similar unmanned satellites, hu- 
man engineering activity during fabrication, test, prelaunch, and operational phases would in- 
clude reviewing and analyzing failure reports for human errors during production and testing 


9 Based on pp. 64-67 of ref. 29. 
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operations, reviewing procedures, and observing specific maintenance and checkout activities at 
the launch sites. For the most part these activities would be performed at an intermediate level 
of effort. 

It is emphasized that the meticulous review and "rehearsal" of all flight test and operational 
procedures is of paramount importance for any space system. Detection and elimination of po- 
tential sources of human error are an integral part of this activity. However, on a system of the 
MDSS type, this would be conducted as a mainstream project activity and often would not be 
identified as a separate human engineering activity. 
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APPENDIX A 

Reliability Program Provision Concerning Prevention 

of Human Error 


The following reliability program provision for space system contractors is taken directly 
from NASA Reliability Publication NPC 250-1 (ref. 5): 

3.5 Maintainability and Elimination of Human- Induced Failure 

The contractor shall give careful consideration to the maintainability of the sys- 
tem and to the elimination of potential sources of human-induced failure through- 
out the entire contractual effort— from basic design through operational use. 

This shall include the following: 

a. A study of requirements for test, checkout, inspection, parts or components 
replacement, disassembly and assembly, and self- monitoring, followed by 
provision of access and other design features to facilitate performance of all 
checkout, repair and maintenance tasks. 

b. An intensive effort directed toward making proper and safe use of the equip- 
ment convenient and toward making improper or unsafe use inconvenient 

or extremely difficult, thus enhancing the system’s capability to be fabri- 
cated, handled, maintained and operated with maximum facility and minimum 
hazard to life and equipment. This effort shall cover the design of the equip- 
ment and all instructional material and training associated with its handling, 
storage, transportation, checkout and use. 

Effective effort in these areas is an important means of enhancing reliability in 
any system, is particularly so in ground support equipment, and is absolutely 
vital in providing the necessary reliability for crew safety in manned spaceflight 
vehicles. Features to eliminate potential human- induced failures and to enhance 
maintainability of the system shall be given careful consideration in all design 
reviews . 


35 



preceding 


page blank 


n ot flU* 60 ' 


APPENDIX B 

Definitions 


The following definitions apply to terms as used in this publication. 

Accessibility - A quality of design that permits ready and adequate access for testing, fault de- 
tection, and repair or replacement (ref. 30). 

Checklist - A list of procedures or items summarizing the activities required in the performance 
of a task. A condensed guide. An on-the-job supplement to more detailed job instructions. 

Cislunar - Of or pertaining to space between the Earth and the orbit of the Moon, or to a sphere 
of space centered on the Earth with a radius equal to the distance between the Earth and the 
Moon (ref. 30). 

Component - A combination of parts, subassemblies, or assemblies, usually self-contained, 
which performs a distinctive function in the operation of the overall equipment (ref. 5). 

Fail-safe design - Design considerations to prevent probable equipment failures or malfunctions 
which may injure the operator or the equipment (ref. 30). 

Flow chart - Graphic description of the mission(s) which the space system is expected to perform 
and the things which must be done to the system before and after a mission (ref. 25). 

Function analysis - A technique for identifying the human and/or equipment capabilities for ade- 
quately meeting system requirements. Man-machine function analyses (or allocations) are 
primarily conducted to determine whether functions will be performed by man, by machine, 
or by a combination of both. 

Human engineering - The application of scientific knowledge concerning human limitations and 
performance capabilities to the establishment of requirements for accomplishment of the 
mission. The purpose is to minimize demands upon human skill, training, and manpower 
resources, and to maximize the effectiveness of man -equipment combinations (ref. 30). 

Human factors - Used in a broad sense to cover all biomedical and psychosocial considerations 
pertaining to man in the system. It includes principles and applications in the areas of hu- 
man engineering, personnel selection, training, life support requirements, job performance 
aids, and human performance evaluation (ref. 30). 

Human-induced failures - Those failures and malfunctions of equipment components directly at- 
tributable to some act or omission by a human operator. Examples of human-induced failure 
events include: Activation of the wrong control, rough handling, and incorrect wiring. 
Sources of human-induced failures may include: Poor design, incorrect process or test 
procedures, improper inspection, and inadequate training or supervision. 

Human operator - A person who participates in some aspect of operation or support of a space 
system and its associated equipment and facilities. 
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Human- performance assurance - A method or approach for reducing and eliminating sources of 
human-induced failures by implementing an adequate human engineering and serviceability ef- 
fort during the project life cycle of space systems. 

Launch vehicle - The part of the space vehicle which furnishes the propulsion and guidance during 
the initial part of the trajectory to provide the prescribed velocity, position, and attitude re- 
quired for injection into the desired trajectory. 

Launch window - The mission conditions which impose launch time limitations on the launch ve- 
hicle for any given trajectory, such as relative position of Earth and Moon or planets, mid- 
course propulsion capabilities, guidance limits, etc. (ref. 30). 

Link analysis - An analysis of the visual, auditory, and tactual links between man and machine or 
between one man and another involved in an operation. Primary objectives are determination 
of the importance of links, frequency of their use, and their adequacy. 

Maintainability - That quality of the combined features of equipment design and installation which 
facilitates the accomplishment of inspection, test, checkout, servicing, repair, and overhaul 
with a minimum of time, skill, and resources in the planned maintenance environments (ref. 
5). Maintainability includes both "serviceability” and "repairability." This manual empha- 
sizes the former term in its discussions of maintainability, since serviceability is essentially 
an equipment design characteristic important in assuring reliable and effective system per- 
formance . 

Maintenance - The function of retaining material in or restoring it to a serviceable condition (ref. 
30). 

Maintenance task - Any action(s) required to preclude the occurrence of a malfunction or restore 
an equipment to satisfactory operating condition (ref. 30). 

Man- machine function analysis - See "Function analysis." 

Man- rated space vehicle - Space vehicles for manned flight which have achieved the standards of 
performance and reliability previously established as reasonably acceptable for its class of 
equipment (ref. 30). 

MDSS - Micrometeoroid Deep Space Satellite (ref. 23). 

Micrometeoroid - Meteoroids less than 1/2 50th of an inch in diameter. 

Mission analysis - A comprehensive evaluation of all the parameters which affect the events of a 
mission (ref. 30). 

Mission profile - A time-sequence description of the events required, as well as the necessary 
locations and conditions of their occurrence, in order to accomplish the objectives of the 
mission. 

Mission task - The specified purpose for which a device must perform (ref. 30). 

Mockup - A replica or dummy. For human factors analysis a mockup is usually full-sized. 

Mockup inspection - An inspection of a mockup to determine the operational suitability of the con- 
figuration and general arrangement of the operational equipment represented (ref. 30). 

Module - A combination of components, contained in one package or common to one mounting, 

which provides a complete function to subsystems and systems in which they operate (ref. 30). 

Operational ground equipment (OGE) - A functional part of a system which operates with the 
aerospace vehicle or end item as an essential operating element thereof (ref. 30). 
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Operational use - The period from beginning of launch countdown through mission completion. 

Operator task - A group of related activities required in performing (with other tasks) a more 
comprehensive system functional activity. 

Personnel requirements - Human activities and behaviors (individual and crew) required for the 
adequate performance of operator and maintenance tasks. 

Procedure - A particular course or mode of action for conducting a business or the formal in- 
structions carrying management approval and governing and prescribing the means by which 
personnel are to operate to accomplish an objective (ref. 30). 

Program - A related series of undertakings designed to accomplish a broad scientific or technical 
goal. Attainment of such long-range goals may be accomplished by implementation of specific 
projects (ref. 30). 

Project - A scheduled undertaking, within a program, which may involve the research and de- 
velopment, design, construction, and operation of system and associated hardware, or hard- 
ware only, to accomplish a scientific or technical objective (ref. 30). 

Prototype - An original or model from which the final hardware design evolves (usually through a 
process of refinement). 

Quality control - A management function to control the quality of articles to conform to quality 
standards (ref. 22). 

Reliability - The probability that system, subsystem, component, or part will perform its 

intended functions under defined conditions at a designated time and for a specified operating 
period (ref. 5). 

Repairability - The probability that, when the actual repair begins, the system will be repaired in 
a given period of time with a given manpower expenditure (ref. 30). 

Serviceability - Equipment design, configuration, installation, and operation that minimize main- 
tenance, inspection, and servicing (ref. 30). Serviceability analyses are performed to de- 
termine what must be accomplished to achieve this objective. (See also "Maintainability.") 

Simulation - A set of test conditions designed to duplicate field operating and usage environments 
(ref. 30). 

Time-line analysis - Reducing or charting a function on a time base. The analysis can be per- 
formed first at the broader functional levels and then be repeated with successively greater 
precision at successively narrower levels of function. 

Work space layout - A design of a work area to include provisions for seating, physical movement 
of human operators, operational maintenance, and other factors permitting adequate person- 
to-person contact and man- machine interaction (ref. 25). 
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